diff --git a/BUILD.bazel b/BUILD.bazel
index 0f6e41e3ab..663cd31949 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -158,16 +158,17 @@ cc_library(
 
 # DEPRECATED: Prefer :well_known_type_protos for the Well-Known Types
 # (https://developers.google.com/protocol-buffers/docs/reference/google.protobuf)
-# or :descriptor_proto(_srcs) for descriptor.proto (source), or
-# :compiler_plugin_proto for compiler/plugin.proto.
+# or :descriptor_proto_srcs for descriptor.proto, or :compiler_plugin_proto_srcs
+# for compiler/plugin.proto.
 filegroup(
     name = "well_known_protos",
     srcs = [
-        "src/google/protobuf/compiler/plugin.proto",
-        "src/google/protobuf/descriptor.proto",
+        ":compiler_plugin_proto_srcs",
+        ":descriptor_proto_srcs",
         ":well_known_type_protos",
     ],
-    deprecation = "Prefer :well_known_type_protos instead.",
+    deprecation = "Prefer :well_known_type_protos, :compiler_plugin_proto, " +
+                  "and :descriptor_proto instead.",
     visibility = ["//visibility:public"],
 )
 
@@ -191,12 +192,24 @@ filegroup(
 filegroup(
     name = "built_in_runtime_protos",
     srcs = [
-        "src/google/protobuf/compiler/plugin.proto",
-        "src/google/protobuf/descriptor.proto",
+        ":descriptor_proto_srcs",
+        ":compiler_plugin_proto_srcs",
     ],
     visibility = ["//:__subpackages__"],
 )
 
+filegroup(
+    name = "descriptor_proto_srcs",
+    srcs = ["src/google/protobuf/descriptor.proto"],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "compiler_plugin_proto_srcs",
+    srcs = ["src/google/protobuf/compiler/plugin.proto"],
+    visibility = ["//visibility:public"],
+)
+
 exports_files(
     srcs = [
         "src/google/protobuf/any.proto",
@@ -342,7 +355,7 @@ proto_library(
 
 proto_library(
     name = "compiler_plugin_proto",
-    srcs = ["src/google/protobuf/compiler/plugin.proto"],
+    srcs = [":compiler_plugin_proto_srcs"],
     strip_import_prefix = "src",
     visibility = ["//visibility:public"],
     deps = ["//:descriptor_proto"],
@@ -350,7 +363,7 @@ proto_library(
 
 proto_library(
     name = "descriptor_proto",
-    srcs = ["src/google/protobuf/descriptor.proto"],
+    srcs = [":descriptor_proto_srcs"],
     strip_import_prefix = "src",
     visibility = ["//visibility:public"],
 )
diff --git a/CHANGES.txt b/CHANGES.txt
index cf6a74db8f..5dd6f2ea7c 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,3 +1,11 @@
+2022-12-13 version 21.12 (C++/Java/Python/PHP/Objective-C/C#/Ruby)
+
+  Python
+  * Fix broken enum ranges (#11171)
+  * Stop requiring extension fields to have a sythetic oneof (#11091)
+  * Python runtime 4.21.10 not works generated code can not load valid proto.
+    (#11171)
+
 2022-12-07 version 21.11 (C++/Java/Python/PHP/Objective-C/C#/Ruby)
   Python
   * Add license file to pypi wheels (#10936)
diff --git a/Makefile.am b/Makefile.am
index 681cd8c21c..264842f1c3 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -343,6 +343,7 @@ java_EXTRA_DIST=
   java/core/src/main/java/com/google/protobuf/Internal.java                        \
   java/core/src/main/java/com/google/protobuf/InvalidProtocolBufferException.java  \
   java/core/src/main/java/com/google/protobuf/IterableByteBufferInputStream.java   \
+  java/core/src/main/java/com/google/protobuf/Java8Compatibility.java              \
   java/core/src/main/java/com/google/protobuf/JavaType.java                        \
   java/core/src/main/java/com/google/protobuf/LazyField.java                       \
   java/core/src/main/java/com/google/protobuf/LazyFieldLite.java                   \
diff --git a/Protobuf-C++.podspec b/Protobuf-C++.podspec
index 0c61573c4a..43a32132d0 100644
--- a/Protobuf-C++.podspec
+++ b/Protobuf-C++.podspec
@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name     = 'Protobuf-C++'
-  s.version  = '3.21.11'
+  s.version  = '3.21.12'
   s.summary  = 'Protocol Buffers v3 runtime library for C++.'
   s.homepage = 'https://github.com/google/protobuf'
   s.license  = 'BSD-3-Clause'
diff --git a/Protobuf.podspec b/Protobuf.podspec
index 9f9df1577c..ebb533d2f4 100644
--- a/Protobuf.podspec
+++ b/Protobuf.podspec
@@ -5,7 +5,7 @@
 # dependent projects use the :git notation to refer to the library.
 Pod::Spec.new do |s|
   s.name     = 'Protobuf'
-  s.version  = '3.21.11'
+  s.version  = '3.21.12'
   s.summary  = 'Protocol Buffers v.3 runtime library for Objective-C.'
   s.homepage = 'https://github.com/protocolbuffers/protobuf'
   s.license  = 'BSD-3-Clause'
diff --git a/configure.ac b/configure.ac
index 517b497222..7243fd3118 100644
--- a/configure.ac
+++ b/configure.ac
@@ -17,7 +17,7 @@ AC_PREREQ(2.59)
 # In the SVN trunk, the version should always be the next anticipated release
 # version with the "-pre" suffix.  (We used to use "-SNAPSHOT" but this pushed
 # the size of one file name in the dist tarfile over the 99-char limit.)
-AC_INIT([Protocol Buffers],[3.21.11],[protobuf@googlegroups.com],[protobuf])
+AC_INIT([Protocol Buffers],[3.21.12],[protobuf@googlegroups.com],[protobuf])
 
 AM_MAINTAINER_MODE([enable])
 
diff --git a/csharp/Google.Protobuf.Tools.nuspec b/csharp/Google.Protobuf.Tools.nuspec
index 8f1bf8bbcf..d74008a1c0 100644
--- a/csharp/Google.Protobuf.Tools.nuspec
+++ b/csharp/Google.Protobuf.Tools.nuspec
@@ -5,7 +5,7 @@
     <title>Google Protocol Buffers tools</title>
     <summary>Tools for Protocol Buffers - Google's data interchange format.</summary>
     <description>See project site for more info.</description>
-    <version>3.21.11</version>
+    <version>3.21.12</version>
     <authors>Google Inc.</authors>
     <owners>protobuf-packages</owners>
     <licenseUrl>https://github.com/protocolbuffers/protobuf/blob/main/LICENSE</licenseUrl>
diff --git a/csharp/src/Google.Protobuf/Google.Protobuf.csproj b/csharp/src/Google.Protobuf/Google.Protobuf.csproj
index 8ebc31e91c..3c42b9e92a 100644
--- a/csharp/src/Google.Protobuf/Google.Protobuf.csproj
+++ b/csharp/src/Google.Protobuf/Google.Protobuf.csproj
@@ -4,7 +4,7 @@
     <Description>C# runtime library for Protocol Buffers - Google's data interchange format.</Description>
     <Copyright>Copyright 2015, Google Inc.</Copyright>
     <AssemblyTitle>Google Protocol Buffers</AssemblyTitle>
-    <VersionPrefix>3.21.11</VersionPrefix>
+    <VersionPrefix>3.21.12</VersionPrefix>
     <!-- C# 7.2 is required for Span/BufferWriter/ReadOnlySequence -->
     <LangVersion>7.2</LangVersion>
     <Authors>Google Inc.</Authors>
diff --git a/java/README.md b/java/README.md
index 1b0ac91b5c..5df8114b7d 100644
--- a/java/README.md
+++ b/java/README.md
@@ -23,7 +23,7 @@ If you are using Maven, use the following:
 <dependency>
   <groupId>com.google.protobuf</groupId>
   <artifactId>protobuf-java</artifactId>
-  <version>3.21.11</version>
+  <version>3.21.12</version>
 </dependency>
 ```
 
@@ -37,7 +37,7 @@ protobuf-java-util package:
 <dependency>
   <groupId>com.google.protobuf</groupId>
   <artifactId>protobuf-java-util</artifactId>
-  <version>3.21.11</version>
+  <version>3.21.12</version>
 </dependency>
 ```
 
@@ -45,7 +45,7 @@ protobuf-java-util package:
 
 If you are using Gradle, add the following to your `build.gradle` file's dependencies:
 ```
-    implementation 'com.google.protobuf:protobuf-java:3.21.11'
+    implementation 'com.google.protobuf:protobuf-java:3.21.12'
 ```
 Again, be sure to check that the version number matches (or is newer than) the version number of protoc that you are using.
 
diff --git a/java/bom/pom.xml b/java/bom/pom.xml
index eaec5aaf55..31816764bf 100644
--- a/java/bom/pom.xml
+++ b/java/bom/pom.xml
@@ -4,7 +4,7 @@
 
   <groupId>com.google.protobuf</groupId>
   <artifactId>protobuf-bom</artifactId>
-  <version>3.21.11</version>
+  <version>3.21.12</version>
   <packaging>pom</packaging>
 
   <name>Protocol Buffers [BOM]</name>
diff --git a/java/core/BUILD.bazel b/java/core/BUILD.bazel
index cfd53f42e2..9a0a803621 100644
--- a/java/core/BUILD.bazel
+++ b/java/core/BUILD.bazel
@@ -49,6 +49,7 @@ LITE_SRCS = [
     "src/main/java/com/google/protobuf/Internal.java",
     "src/main/java/com/google/protobuf/InvalidProtocolBufferException.java",
     "src/main/java/com/google/protobuf/IterableByteBufferInputStream.java",
+    "src/main/java/com/google/protobuf/Java8Compatibility.java",
     "src/main/java/com/google/protobuf/JavaType.java",
     "src/main/java/com/google/protobuf/LazyField.java",
     "src/main/java/com/google/protobuf/LazyFieldLite.java",
diff --git a/java/core/pom.xml b/java/core/pom.xml
index 79e75c9a81..83b7351f7e 100644
--- a/java/core/pom.xml
+++ b/java/core/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <groupId>com.google.protobuf</groupId>
     <artifactId>protobuf-parent</artifactId>
-    <version>3.21.11</version>
+    <version>3.21.12</version>
   </parent>
 
   <artifactId>protobuf-java</artifactId>
diff --git a/java/core/src/main/java/com/google/protobuf/AllocatedBuffer.java b/java/core/src/main/java/com/google/protobuf/AllocatedBuffer.java
index 94b09944d1..75de57a32e 100644
--- a/java/core/src/main/java/com/google/protobuf/AllocatedBuffer.java
+++ b/java/core/src/main/java/com/google/protobuf/AllocatedBuffer.java
@@ -189,7 +189,7 @@ abstract class AllocatedBuffer {
 
       @Override
       public AllocatedBuffer position(int position) {
-        buffer.position(position);
+        Java8Compatibility.position(buffer, position);
         return this;
       }
 
diff --git a/java/core/src/main/java/com/google/protobuf/BinaryWriter.java b/java/core/src/main/java/com/google/protobuf/BinaryWriter.java
index cf394e3371..e3854bb1e5 100644
--- a/java/core/src/main/java/com/google/protobuf/BinaryWriter.java
+++ b/java/core/src/main/java/com/google/protobuf/BinaryWriter.java
@@ -2019,8 +2019,8 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       buffers.addFirst(allocatedBuffer);
 
       buffer = nioBuffer;
-      buffer.limit(buffer.capacity());
-      buffer.position(0);
+      Java8Compatibility.limit(buffer, buffer.capacity());
+      Java8Compatibility.position(buffer, 0);
       // Set byte order to little endian for fast writing of fixed 32/64.
       buffer.order(ByteOrder.LITTLE_ENDIAN);
 
@@ -2046,7 +2046,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       if (buffer != null) {
         totalDoneBytes += bytesWrittenToCurrentBuffer();
         // Update the indices on the netty buffer.
-        buffer.position(pos + 1);
+        Java8Compatibility.position(buffer, pos + 1);
         buffer = null;
         pos = 0;
         limitMinusOne = 0;
@@ -2475,7 +2475,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(pos + 1);
+      Java8Compatibility.position(buffer, pos + 1);
       buffer.put(value, offset, length);
     }
 
@@ -2494,7 +2494,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(pos + 1);
+      Java8Compatibility.position(buffer, pos + 1);
       buffer.put(value, offset, length);
     }
 
@@ -2506,7 +2506,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(pos + 1);
+      Java8Compatibility.position(buffer, pos + 1);
       buffer.put(value);
     }
 
@@ -2526,7 +2526,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(pos + 1);
+      Java8Compatibility.position(buffer, pos + 1);
       buffer.put(value);
     }
 
@@ -2576,8 +2576,8 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       buffers.addFirst(allocatedBuffer);
 
       buffer = nioBuffer;
-      buffer.limit(buffer.capacity());
-      buffer.position(0);
+      Java8Compatibility.limit(buffer, buffer.capacity());
+      Java8Compatibility.position(buffer, 0);
 
       bufferOffset = UnsafeUtil.addressOffset(buffer);
       limitMinusOne = bufferOffset + (buffer.limit() - 1);
@@ -2602,7 +2602,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       if (buffer != null) {
         totalDoneBytes += bytesWrittenToCurrentBuffer();
         // Update the indices on the netty buffer.
-        buffer.position(bufferPos() + 1);
+        Java8Compatibility.position(buffer, bufferPos() + 1);
         buffer = null;
         pos = 0;
         limitMinusOne = 0;
@@ -3016,7 +3016,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(bufferPos() + 1);
+      Java8Compatibility.position(buffer, bufferPos() + 1);
       buffer.put(value, offset, length);
     }
 
@@ -3035,7 +3035,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(bufferPos() + 1);
+      Java8Compatibility.position(buffer, bufferPos() + 1);
       buffer.put(value, offset, length);
     }
 
@@ -3047,7 +3047,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(bufferPos() + 1);
+      Java8Compatibility.position(buffer, bufferPos() + 1);
       buffer.put(value);
     }
 
@@ -3067,7 +3067,7 @@ abstract class BinaryWriter extends ByteOutput implements Writer {
       }
 
       pos -= length;
-      buffer.position(bufferPos() + 1);
+      Java8Compatibility.position(buffer, bufferPos() + 1);
       buffer.put(value);
     }
 
diff --git a/java/core/src/main/java/com/google/protobuf/ByteBufferWriter.java b/java/core/src/main/java/com/google/protobuf/ByteBufferWriter.java
index 2cb3ada67f..3970b0ea5b 100644
--- a/java/core/src/main/java/com/google/protobuf/ByteBufferWriter.java
+++ b/java/core/src/main/java/com/google/protobuf/ByteBufferWriter.java
@@ -107,7 +107,7 @@ final class ByteBufferWriter {
       }
     } finally {
       // Restore the initial position.
-      buffer.position(initialPos);
+      Java8Compatibility.position(buffer, initialPos);
     }
   }
 
diff --git a/java/core/src/main/java/com/google/protobuf/CodedOutputStream.java b/java/core/src/main/java/com/google/protobuf/CodedOutputStream.java
index 4ad83099d7..44dd4dc20e 100644
--- a/java/core/src/main/java/com/google/protobuf/CodedOutputStream.java
+++ b/java/core/src/main/java/com/google/protobuf/CodedOutputStream.java
@@ -1271,7 +1271,7 @@ public abstract class CodedOutputStream extends ByteOutput {
         write(value.array(), value.arrayOffset(), value.capacity());
       } else {
         ByteBuffer duplicated = value.duplicate();
-        duplicated.clear();
+        Java8Compatibility.clear(duplicated);
         write(duplicated);
       }
     }
@@ -1522,7 +1522,7 @@ public abstract class CodedOutputStream extends ByteOutput {
     @Override
     public void flush() {
       // Update the position on the buffer.
-      byteBuffer.position(initialPosition + getTotalBytesWritten());
+      Java8Compatibility.position(byteBuffer, initialPosition + getTotalBytesWritten());
     }
   }
 
@@ -1684,7 +1684,7 @@ public abstract class CodedOutputStream extends ByteOutput {
         write(value.array(), value.arrayOffset(), value.capacity());
       } else {
         ByteBuffer duplicated = value.duplicate();
-        duplicated.clear();
+        Java8Compatibility.clear(duplicated);
         write(duplicated);
       }
     }
@@ -1794,18 +1794,18 @@ public abstract class CodedOutputStream extends ByteOutput {
           // Save the current position and increment past the length field. We'll come back
           // and write the length field after the encoding is complete.
           final int startOfBytes = buffer.position() + minLengthVarIntSize;
-          buffer.position(startOfBytes);
+          Java8Compatibility.position(buffer, startOfBytes);
 
           // Encode the string.
           encode(value);
 
           // Now go back to the beginning and write the length.
           int endOfBytes = buffer.position();
-          buffer.position(startPos);
+          Java8Compatibility.position(buffer, startPos);
           writeUInt32NoTag(endOfBytes - startOfBytes);
 
           // Reposition the buffer past the written data.
-          buffer.position(endOfBytes);
+          Java8Compatibility.position(buffer, endOfBytes);
         } else {
           final int length = Utf8.encodedLength(value);
           writeUInt32NoTag(length);
@@ -1813,7 +1813,7 @@ public abstract class CodedOutputStream extends ByteOutput {
         }
       } catch (UnpairedSurrogateException e) {
         // Roll back the change and convert to an IOException.
-        buffer.position(startPos);
+        Java8Compatibility.position(buffer, startPos);
 
         // TODO(nathanmittler): We should throw an IOException here instead.
         inefficientWriteStringNoTag(value, e);
@@ -1826,7 +1826,7 @@ public abstract class CodedOutputStream extends ByteOutput {
     @Override
     public void flush() {
       // Update the position of the original buffer.
-      originalBuffer.position(buffer.position());
+      Java8Compatibility.position(originalBuffer, buffer.position());
     }
 
     @Override
@@ -2014,7 +2014,7 @@ public abstract class CodedOutputStream extends ByteOutput {
         write(value.array(), value.arrayOffset(), value.capacity());
       } else {
         ByteBuffer duplicated = value.duplicate();
-        duplicated.clear();
+        Java8Compatibility.clear(duplicated);
         write(duplicated);
       }
     }
@@ -2150,7 +2150,7 @@ public abstract class CodedOutputStream extends ByteOutput {
           // Save the current position and increment past the length field. We'll come back
           // and write the length field after the encoding is complete.
           int stringStart = bufferPos(position) + minLengthVarIntSize;
-          buffer.position(stringStart);
+          Java8Compatibility.position(buffer, stringStart);
 
           // Encode the string.
           Utf8.encodeUtf8(value, buffer);
@@ -2187,7 +2187,7 @@ public abstract class CodedOutputStream extends ByteOutput {
     @Override
     public void flush() {
       // Update the position of the original buffer.
-      originalBuffer.position(bufferPos(position));
+      Java8Compatibility.position(originalBuffer, bufferPos(position));
     }
 
     @Override
@@ -2201,7 +2201,7 @@ public abstract class CodedOutputStream extends ByteOutput {
     }
 
     private void repositionBuffer(long pos) {
-      buffer.position(bufferPos(pos));
+      Java8Compatibility.position(buffer, bufferPos(pos));
     }
 
     private int bufferPos(long pos) {
@@ -2478,7 +2478,7 @@ public abstract class CodedOutputStream extends ByteOutput {
         write(value.array(), value.arrayOffset(), value.capacity());
       } else {
         ByteBuffer duplicated = value.duplicate();
-        duplicated.clear();
+        Java8Compatibility.clear(duplicated);
         write(duplicated);
       }
     }
@@ -2792,7 +2792,7 @@ public abstract class CodedOutputStream extends ByteOutput {
         write(value.array(), value.arrayOffset(), value.capacity());
       } else {
         ByteBuffer duplicated = value.duplicate();
-        duplicated.clear();
+        Java8Compatibility.clear(duplicated);
         write(duplicated);
       }
     }
diff --git a/java/core/src/main/java/com/google/protobuf/Internal.java b/java/core/src/main/java/com/google/protobuf/Internal.java
index b6bbcb160d..6e4490e254 100644
--- a/java/core/src/main/java/com/google/protobuf/Internal.java
+++ b/java/core/src/main/java/com/google/protobuf/Internal.java
@@ -313,7 +313,11 @@ public final class Internal {
     }
     // ByteBuffer.equals() will only compare the remaining bytes, but we want to
     // compare all the content.
-    return a.duplicate().clear().equals(b.duplicate().clear());
+    ByteBuffer aDuplicate = a.duplicate();
+    Java8Compatibility.clear(aDuplicate);
+    ByteBuffer bDuplicate = b.duplicate();
+    Java8Compatibility.clear(bDuplicate);
+    return aDuplicate.equals(bDuplicate);
   }
 
   /** Helper method for implementing {@link Message#equals(Object)} for bytes field. */
@@ -353,7 +357,7 @@ public final class Internal {
           bytes.capacity() > DEFAULT_BUFFER_SIZE ? DEFAULT_BUFFER_SIZE : bytes.capacity();
       final byte[] buffer = new byte[bufferSize];
       final ByteBuffer duplicated = bytes.duplicate();
-      duplicated.clear();
+      Java8Compatibility.clear(duplicated);
       int h = bytes.capacity();
       while (duplicated.remaining() > 0) {
         final int length =
diff --git a/java/core/src/main/java/com/google/protobuf/IterableByteBufferInputStream.java b/java/core/src/main/java/com/google/protobuf/IterableByteBufferInputStream.java
index 713e806469..1e571cfbbb 100644
--- a/java/core/src/main/java/com/google/protobuf/IterableByteBufferInputStream.java
+++ b/java/core/src/main/java/com/google/protobuf/IterableByteBufferInputStream.java
@@ -140,9 +140,9 @@ class IterableByteBufferInputStream extends InputStream {
       updateCurrentByteBufferPos(length);
     } else {
       int prevPos = currentByteBuffer.position();
-      currentByteBuffer.position(currentByteBufferPos);
+      Java8Compatibility.position(currentByteBuffer, currentByteBufferPos);
       currentByteBuffer.get(output, offset, length);
-      currentByteBuffer.position(prevPos);
+      Java8Compatibility.position(currentByteBuffer, prevPos);
       updateCurrentByteBufferPos(length);
     }
     return length;
diff --git a/java/core/src/main/java/com/google/protobuf/Java8Compatibility.java b/java/core/src/main/java/com/google/protobuf/Java8Compatibility.java
new file mode 100644
index 0000000000..ef181c2ae5
--- /dev/null
+++ b/java/core/src/main/java/com/google/protobuf/Java8Compatibility.java
@@ -0,0 +1,67 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package com.google.protobuf;
+
+import java.nio.Buffer;
+
+/**
+ * Wrappers around {@link Buffer} methods that are covariantly overridden in Java 9+. See
+ * https://github.com/protocolbuffers/protobuf/issues/11393
+ *
+ * <p>TODO(b/270454719) remove when Java 8 support is no longer needed.
+ */
+final class Java8Compatibility {
+  static void clear(Buffer b) {
+    b.clear();
+  }
+
+  static void flip(Buffer b) {
+    b.flip();
+  }
+
+  static void limit(Buffer b, int limit) {
+    b.limit(limit);
+  }
+
+  static void mark(Buffer b) {
+    b.mark();
+  }
+
+  static void position(Buffer b, int position) {
+    b.position(position);
+  }
+
+  static void reset(Buffer b) {
+    b.reset();
+  }
+
+  private Java8Compatibility() {}
+}
diff --git a/java/core/src/main/java/com/google/protobuf/MessageSchema.java b/java/core/src/main/java/com/google/protobuf/MessageSchema.java
index 084d687d1a..ae5dddc53b 100644
--- a/java/core/src/main/java/com/google/protobuf/MessageSchema.java
+++ b/java/core/src/main/java/com/google/protobuf/MessageSchema.java
@@ -5510,6 +5510,12 @@ final class MessageSchema<T> implements Schema<T> {
             getMessageFieldSchema(pos).makeImmutable(UNSAFE.getObject(message, offset));
           }
           break;
+        case 60: // ONEOF_MESSAGE
+        case 68: // ONEOF_GROUP
+          if (isOneofPresent(message, numberAt(pos), pos)) {
+            getMessageFieldSchema(pos).makeImmutable(UNSAFE.getObject(message, offset));
+          }
+          break;
         case 18: // DOUBLE_LIST:
         case 19: // FLOAT_LIST:
         case 20: // INT64_LIST:
diff --git a/java/core/src/main/java/com/google/protobuf/NioByteString.java b/java/core/src/main/java/com/google/protobuf/NioByteString.java
index 1e594ff878..f625edafb9 100644
--- a/java/core/src/main/java/com/google/protobuf/NioByteString.java
+++ b/java/core/src/main/java/com/google/protobuf/NioByteString.java
@@ -37,7 +37,6 @@ import java.io.InputStream;
 import java.io.InvalidObjectException;
 import java.io.ObjectInputStream;
 import java.io.OutputStream;
-import java.nio.Buffer;
 import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
 import java.nio.InvalidMarkException;
@@ -110,7 +109,7 @@ final class NioByteString extends ByteString.LeafByteString {
   protected void copyToInternal(
       byte[] target, int sourceOffset, int targetOffset, int numberToCopy) {
     ByteBuffer slice = buffer.slice();
-    ((Buffer) slice).position(sourceOffset);
+    Java8Compatibility.position(slice, sourceOffset);
     slice.get(target, targetOffset, numberToCopy);
   }
 
@@ -224,7 +223,7 @@ final class NioByteString extends ByteString.LeafByteString {
 
       @Override
       public void mark(int readlimit) {
-        buf.mark();
+        Java8Compatibility.mark(buf);
       }
 
       @Override
@@ -235,7 +234,7 @@ final class NioByteString extends ByteString.LeafByteString {
       @Override
       public void reset() throws IOException {
         try {
-          buf.reset();
+          Java8Compatibility.reset(buf);
         } catch (InvalidMarkException e) {
           throw new IOException(e);
         }
@@ -286,8 +285,8 @@ final class NioByteString extends ByteString.LeafByteString {
     }
 
     ByteBuffer slice = buffer.slice();
-    ((Buffer) slice).position(beginIndex - buffer.position());
-    ((Buffer) slice).limit(endIndex - buffer.position());
+    Java8Compatibility.position(slice, beginIndex - buffer.position());
+    Java8Compatibility.limit(slice, endIndex - buffer.position());
     return slice;
   }
 }
diff --git a/java/core/src/main/java/com/google/protobuf/TextFormat.java b/java/core/src/main/java/com/google/protobuf/TextFormat.java
index a8af84506b..1fb4452a3f 100644
--- a/java/core/src/main/java/com/google/protobuf/TextFormat.java
+++ b/java/core/src/main/java/com/google/protobuf/TextFormat.java
@@ -1717,7 +1717,7 @@ public final class TextFormat {
         if (n == -1) {
           break;
         }
-        buffer.flip();
+        Java8Compatibility.flip(buffer);
         text.append(buffer, 0, n);
       }
       return text;
diff --git a/java/core/src/main/java/com/google/protobuf/Utf8.java b/java/core/src/main/java/com/google/protobuf/Utf8.java
index c74497cd81..7c6823d91f 100644
--- a/java/core/src/main/java/com/google/protobuf/Utf8.java
+++ b/java/core/src/main/java/com/google/protobuf/Utf8.java
@@ -770,7 +770,7 @@ final class Utf8 {
       if (out.hasArray()) {
         final int offset = out.arrayOffset();
         int endIndex = Utf8.encode(in, out.array(), offset + out.position(), out.remaining());
-        out.position(endIndex - offset);
+        Java8Compatibility.position(out, endIndex - offset);
       } else if (out.isDirect()) {
         encodeUtf8Direct(in, out);
       } else {
@@ -801,7 +801,7 @@ final class Utf8 {
         }
         if (inIx == inLength) {
           // Successfully encoded the entire string.
-          out.position(outIx + inIx);
+          Java8Compatibility.position(out, outIx + inIx);
           return;
         }
 
@@ -844,7 +844,7 @@ final class Utf8 {
         }
 
         // Successfully encoded the entire string.
-        out.position(outIx);
+        Java8Compatibility.position(out, outIx);
       } catch (IndexOutOfBoundsException e) {
         // TODO(nathanmittler): Consider making the API throw IndexOutOfBoundsException instead.
 
@@ -1545,7 +1545,7 @@ final class Utf8 {
       }
       if (inIx == inLimit) {
         // We're done, it was ASCII encoded.
-        out.position((int) (outIx - address));
+        Java8Compatibility.position(out, (int) (outIx - address));
         return;
       }
 
@@ -1585,7 +1585,7 @@ final class Utf8 {
       }
 
       // All bytes have been encoded.
-      out.position((int) (outIx - address));
+      Java8Compatibility.position(out, (int) (outIx - address));
     }
 
     /**
diff --git a/java/kotlin-lite/pom.xml b/java/kotlin-lite/pom.xml
index 18a134c702..50dcc8340b 100644
--- a/java/kotlin-lite/pom.xml
+++ b/java/kotlin-lite/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <groupId>com.google.protobuf</groupId>
     <artifactId>protobuf-parent</artifactId>
-    <version>3.21.11</version>
+    <version>3.21.12</version>
   </parent>
 
   <artifactId>protobuf-kotlin-lite</artifactId>
diff --git a/java/kotlin/pom.xml b/java/kotlin/pom.xml
index ab24dda087..9cc9ea0323 100644
--- a/java/kotlin/pom.xml
+++ b/java/kotlin/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <groupId>com.google.protobuf</groupId>
     <artifactId>protobuf-parent</artifactId>
-    <version>3.21.11</version>
+    <version>3.21.12</version>
   </parent>
 
   <artifactId>protobuf-kotlin</artifactId>
diff --git a/java/lite.md b/java/lite.md
index 9a6adcb861..ad920792f3 100644
--- a/java/lite.md
+++ b/java/lite.md
@@ -29,7 +29,7 @@ protobuf Java Lite runtime. If you are using Maven, include the following:
 <dependency>
   <groupId>com.google.protobuf</groupId>
   <artifactId>protobuf-javalite</artifactId>
-  <version>3.21.11</version>
+  <version>3.21.12</version>
 </dependency>
 ```
 
diff --git a/java/lite/pom.xml b/java/lite/pom.xml
index e394118607..8791e4ad19 100644
--- a/java/lite/pom.xml
+++ b/java/lite/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <groupId>com.google.protobuf</groupId>
     <artifactId>protobuf-parent</artifactId>
-    <version>3.21.11</version>
+    <version>3.21.12</version>
   </parent>
 
   <artifactId>protobuf-javalite</artifactId>
@@ -125,6 +125,7 @@
                     <include>Internal.java</include>
                     <include>InvalidProtocolBufferException.java</include>
                     <include>IterableByteBufferInputStream.java</include>
+                    <include>Java8Compatibility.java</include>
                     <include>JavaType.java</include>
                     <include>LazyField.java</include>
                     <include>LazyFieldLite.java</include>
diff --git a/java/lite/src/test/java/com/google/protobuf/LiteTest.java b/java/lite/src/test/java/com/google/protobuf/LiteTest.java
index 801303b344..3b2285fcf2 100644
--- a/java/lite/src/test/java/com/google/protobuf/LiteTest.java
+++ b/java/lite/src/test/java/com/google/protobuf/LiteTest.java
@@ -189,6 +189,18 @@ public class LiteTest {
     }
   }
 
+  @Test
+  public void testParsedOneofSubMessageIsImmutable() throws InvalidProtocolBufferException {
+    TestAllTypesLite message =
+        TestAllTypesLite.parseFrom(
+            TestAllTypesLite.newBuilder()
+                .setOneofNestedMessage(NestedMessage.newBuilder().addDd(1234).build())
+                .build()
+                .toByteArray());
+    IntArrayList subList = (IntArrayList) message.getOneofNestedMessage().getDdList();
+    assertThat(subList.isModifiable()).isFalse();
+  }
+
   @Test
   public void testMemoization() throws Exception {
     GeneratedMessageLite<?, ?> message = TestUtilLite.getAllLiteExtensionsSet();
@@ -2349,8 +2361,7 @@ public class LiteTest {
     Foo fooWithOnlyValue = Foo.newBuilder().setValue(1).build();
 
     Foo fooWithValueAndExtension =
-        fooWithOnlyValue
-            .toBuilder()
+        fooWithOnlyValue.toBuilder()
             .setValue(1)
             .setExtension(Bar.fooExt, Bar.newBuilder().setName("name").build())
             .build();
@@ -2366,8 +2377,7 @@ public class LiteTest {
     Foo fooWithOnlyValue = Foo.newBuilder().setValue(1).build();
 
     Foo fooWithValueAndExtension =
-        fooWithOnlyValue
-            .toBuilder()
+        fooWithOnlyValue.toBuilder()
             .setValue(1)
             .setExtension(Bar.fooExt, Bar.newBuilder().setName("name").build())
             .build();
@@ -2499,9 +2509,9 @@ public class LiteTest {
       assertWithMessage("expected exception").fail();
     } catch (InvalidProtocolBufferException expected) {
       assertThat(
-          TestAllExtensionsLite.newBuilder()
-              .setExtension(UnittestLite.optionalInt32ExtensionLite, 123)
-              .build())
+              TestAllExtensionsLite.newBuilder()
+                  .setExtension(UnittestLite.optionalInt32ExtensionLite, 123)
+                  .build())
           .isEqualTo(expected.getUnfinishedMessage());
     }
   }
diff --git a/java/pom.xml b/java/pom.xml
index 16c6715ec2..863d07f869 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -4,7 +4,7 @@
 
   <groupId>com.google.protobuf</groupId>
   <artifactId>protobuf-parent</artifactId>
-  <version>3.21.11</version>
+  <version>3.21.12</version>
   <packaging>pom</packaging>
 
   <name>Protocol Buffers [Parent]</name>
diff --git a/java/util/pom.xml b/java/util/pom.xml
index 05f7b97c7e..c13df651c8 100644
--- a/java/util/pom.xml
+++ b/java/util/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <groupId>com.google.protobuf</groupId>
     <artifactId>protobuf-parent</artifactId>
-    <version>3.21.11</version>
+    <version>3.21.12</version>
   </parent>
 
   <artifactId>protobuf-java-util</artifactId>
diff --git a/kokoro/macos/prepare_build_macos_rc b/kokoro/macos/prepare_build_macos_rc
index 7a150c79fb..d9677e966b 100755
--- a/kokoro/macos/prepare_build_macos_rc
+++ b/kokoro/macos/prepare_build_macos_rc
@@ -26,7 +26,6 @@ export CXX=g++
 
 ##
 # Install Python 2 by default
-
 eval "$(pyenv init -)"
 pyenv install -v -s 2.7.18 && pyenv global 2.7.18
 
@@ -34,6 +33,9 @@ pyenv install -v -s 2.7.18 && pyenv global 2.7.18
 # Install Tox
 
 if [[ "${KOKORO_INSTALL_TOX:-}" == "yes" ]] ; then
+  # pyenv needs to be directed towards its dependencies.
+  CFLAGS="-I$(brew --prefix zlib)/include" \
+  LDFLAGS="-L$(brew --prefix zlib)/lib" \
   pyenv install -v -s 3.7.13
   pyenv global 3.7.13
   sudo python -m pip install --upgrade pip 'tox==3.27.1' tox-pyenv
diff --git a/kokoro/release/collect_all_artifacts.sh b/kokoro/release/collect_all_artifacts.sh
index 6e0d152408..8b38b6d995 100755
--- a/kokoro/release/collect_all_artifacts.sh
+++ b/kokoro/release/collect_all_artifacts.sh
@@ -6,6 +6,7 @@ set -ex
 cd $(dirname $0)/../..
 
 # Initialize any submodules.
+git config --global --add safe.directory '*'
 git submodule update --init --recursive
 
 # The directory with all resulting artifacts
@@ -23,40 +24,3 @@ ls -R ${INPUT_ARTIFACTS_DIR}
 # TODO(jtattermusch): the directory layout of the artifact builds is pretty messy,
 # so will be the output artifacts of this job.
 cp -r ${INPUT_ARTIFACTS_DIR}/* artifacts
-
-# ====================================
-# Build Google.Protobuf.Tools C# nuget
-# The reason it's being done in this script is that we need access to protoc binaries
-# built on multiple platform (the build is performed by the "build artifact" step)
-# and adding and extra chained build just for building the Google.Protobuf.Tools
-# nuget seems like an overkill.
-cd csharp
-mkdir -p protoc/windows_x86
-mkdir -p protoc/windows_x64
-cp ${INPUT_ARTIFACTS_DIR}/build32/Release/protoc.exe protoc/windows_x86/protoc.exe
-cp ${INPUT_ARTIFACTS_DIR}/build64/Release/protoc.exe protoc/windows_x64/protoc.exe
-
-mkdir -p protoc/linux_x86
-mkdir -p protoc/linux_x64
-# Because of maven unrelated reasonse the linux protoc binaries have a dummy .exe extension.
-# For the Google.Protobuf.Tools nuget, we don't want that exception, so we just remove it.
-cp ${INPUT_ARTIFACTS_DIR}/protoc-artifacts/target/linux/x86_32/protoc.exe protoc/linux_x86/protoc
-cp ${INPUT_ARTIFACTS_DIR}/protoc-artifacts/target/linux/x86_64/protoc.exe protoc/linux_x64/protoc
-
-mkdir -p protoc/macosx_x64
-cp ${INPUT_ARTIFACTS_DIR}/build64/src/protoc protoc/macosx_x64/protoc
-
-# Install nuget (will also install  mono)
-# TODO(jtattermusch): use "mono:5.14" docker image instead so we don't have to apt-get install
-sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
-echo "deb https://download.mono-project.com/repo/ubuntu stable-xenial main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
-# NVidia has stopped publishing Cuda packages for Ubuntu 16.04, so we need to
-# delete this file to allow the apt update to run successfully.
-sudo rm -f /etc/apt/sources.list.d/cuda.list
-sudo apt update
-sudo apt-get install -y nuget
-
-nuget pack Google.Protobuf.Tools.nuspec
-
-# Copy the nupkg to the output artifacts
-cp Google.Protobuf.Tools.*.nupkg ../artifacts
diff --git a/kokoro/release/python/macos/build_artifacts.sh b/kokoro/release/python/macos/build_artifacts.sh
index d79d2f6b40..15ac5dc893 100755
--- a/kokoro/release/python/macos/build_artifacts.sh
+++ b/kokoro/release/python/macos/build_artifacts.sh
@@ -8,6 +8,9 @@ brew uninstall -f protobuf
 # change to repo root
 pushd $(dirname $0)/../../../..
 
+chmod ugo+x ${KOKORO_GFILE_DIR}/use_bazel.sh
+${KOKORO_GFILE_DIR}/use_bazel.sh 5.1.1
+
 # Create stage dir
 ORIGINAL_DIR=`pwd`
 pushd ..
diff --git a/kokoro/release/python/macos/continuous.cfg b/kokoro/release/python/macos/continuous.cfg
index 85cf81b507..95f32358e0 100644
--- a/kokoro/release/python/macos/continuous.cfg
+++ b/kokoro/release/python/macos/continuous.cfg
@@ -6,3 +6,5 @@ action {
     regex: "github/protobuf/artifacts/**"
   }
 }
+
+gfile_resources: "/google_src/files/head/depot/google3/devtools/kokoro/vanadium/linux_scripts/usr/local/bin/use_bazel.sh"
diff --git a/kokoro/release/python/macos/presubmit.cfg b/kokoro/release/python/macos/presubmit.cfg
index 85cf81b507..95f32358e0 100644
--- a/kokoro/release/python/macos/presubmit.cfg
+++ b/kokoro/release/python/macos/presubmit.cfg
@@ -6,3 +6,5 @@ action {
     regex: "github/protobuf/artifacts/**"
   }
 }
+
+gfile_resources: "/google_src/files/head/depot/google3/devtools/kokoro/vanadium/linux_scripts/usr/local/bin/use_bazel.sh"
diff --git a/kokoro/release/python/macos/release.cfg b/kokoro/release/python/macos/release.cfg
index 85cf81b507..95f32358e0 100644
--- a/kokoro/release/python/macos/release.cfg
+++ b/kokoro/release/python/macos/release.cfg
@@ -6,3 +6,5 @@ action {
     regex: "github/protobuf/artifacts/**"
   }
 }
+
+gfile_resources: "/google_src/files/head/depot/google3/devtools/kokoro/vanadium/linux_scripts/usr/local/bin/use_bazel.sh"
diff --git a/kokoro/release/ruby/macos/build_artifacts.sh b/kokoro/release/ruby/macos/build_artifacts.sh
index a109d45b61..2d3424b076 100755
--- a/kokoro/release/ruby/macos/build_artifacts.sh
+++ b/kokoro/release/ruby/macos/build_artifacts.sh
@@ -1,10 +1,13 @@
 #!/bin/bash
 
 set -ex
-
+  
 # change to repo root
 cd $(dirname $0)/../../../..
 
+chmod ugo+x ${KOKORO_GFILE_DIR}/use_bazel.sh
+${KOKORO_GFILE_DIR}/use_bazel.sh 5.1.1
+
 # all artifacts come here
 mkdir artifacts
 export ARTIFACT_DIR=$(pwd)/artifacts
diff --git a/kokoro/release/ruby/macos/continuous.cfg b/kokoro/release/ruby/macos/continuous.cfg
index cb1c08bb88..6b285cd3d9 100644
--- a/kokoro/release/ruby/macos/continuous.cfg
+++ b/kokoro/release/ruby/macos/continuous.cfg
@@ -6,3 +6,5 @@ action {
     regex: "github/protobuf/artifacts/**"
   }
 }
+
+gfile_resources: "/google_src/files/head/depot/google3/devtools/kokoro/vanadium/linux_scripts/usr/local/bin/use_bazel.sh"
diff --git a/kokoro/release/ruby/macos/presubmit.cfg b/kokoro/release/ruby/macos/presubmit.cfg
index cb1c08bb88..6b285cd3d9 100644
--- a/kokoro/release/ruby/macos/presubmit.cfg
+++ b/kokoro/release/ruby/macos/presubmit.cfg
@@ -6,3 +6,5 @@ action {
     regex: "github/protobuf/artifacts/**"
   }
 }
+
+gfile_resources: "/google_src/files/head/depot/google3/devtools/kokoro/vanadium/linux_scripts/usr/local/bin/use_bazel.sh"
diff --git a/kokoro/release/ruby/macos/release.cfg b/kokoro/release/ruby/macos/release.cfg
index cb1c08bb88..6b285cd3d9 100644
--- a/kokoro/release/ruby/macos/release.cfg
+++ b/kokoro/release/ruby/macos/release.cfg
@@ -6,3 +6,5 @@ action {
     regex: "github/protobuf/artifacts/**"
   }
 }
+
+gfile_resources: "/google_src/files/head/depot/google3/devtools/kokoro/vanadium/linux_scripts/usr/local/bin/use_bazel.sh"
diff --git a/kokoro/release/ruby/macos/ruby/ruby_build_environment.sh b/kokoro/release/ruby/macos/ruby/ruby_build_environment.sh
index 92ea53f1f3..81ceca1036 100755
--- a/kokoro/release/ruby/macos/ruby/ruby_build_environment.sh
+++ b/kokoro/release/ruby/macos/ruby/ruby_build_environment.sh
@@ -21,11 +21,11 @@ set -e  # rvm commands are very verbose
 time rvm install 2.5.0
 rvm use 2.5.0
 gem install rake-compiler --no-document
-gem install bundler -v 2.4.22 --no-document
+gem install bundler -v 2.3.26 --no-document
 time rvm install 3.1.0
 rvm use 3.1.0
 gem install rake-compiler --no-document
-gem install bundler -v 2.4.22 --no-document
+gem install bundler --no-document
 time rvm install 2.7.0
 rvm use 2.7.0 --default
 gem install rake-compiler --no-document
diff --git a/php/ext/google/protobuf/php-upb.c b/php/ext/google/protobuf/php-upb.c
index 602509a64a..7ccb946143 100644
--- a/php/ext/google/protobuf/php-upb.c
+++ b/php/ext/google/protobuf/php-upb.c
@@ -6143,7 +6143,6 @@ upb_EnumReservedRange* _upb_EnumReservedRanges_New(
         google_protobuf_EnumDescriptorProto_EnumReservedRange_start(protos[i]);
     const int32_t end =
         google_protobuf_EnumDescriptorProto_EnumReservedRange_end(protos[i]);
-    const int32_t max = kUpb_MaxFieldNumber + 1;
 
     // A full validation would also check that each range is disjoint, and that
     // none of the fields overlap with the extension ranges, but we are just
@@ -6151,7 +6150,7 @@ upb_EnumReservedRange* _upb_EnumReservedRanges_New(
 
     // Note: Not a typo! Unlike extension ranges and message reserved ranges,
     // the end value of an enum reserved range is *inclusive*!
-    if (start < 1 || end < start || end > max) {
+    if (end < start) {
       symtab_errf(ctx, "Reserved range (%d, %d) is invalid, enum=%s\n",
                            (int)start, (int)end, upb_EnumDef_FullName(e));
     }
@@ -8184,7 +8183,7 @@ static void create_fielddef(
     CHK_OOM(
         upb_strtable_insert(&oneof->ntof, name.data, name.size, v, ctx->arena));
   } else {
-    if (f->proto3_optional_) {
+    if (f->proto3_optional_ && !is_extension) {
       symtab_errf(ctx, "field with proto3_optional was not in a oneof (%s)",
                   f->full_name);
     }
diff --git a/php/ext/google/protobuf/protobuf.h b/php/ext/google/protobuf/protobuf.h
index 616ab68566..efbd45eac0 100644
--- a/php/ext/google/protobuf/protobuf.h
+++ b/php/ext/google/protobuf/protobuf.h
@@ -127,7 +127,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_setter, 0, 0, 1)
   ZEND_ARG_INFO(0, value)
 ZEND_END_ARG_INFO()
 
-#define PHP_PROTOBUF_VERSION "3.21.11"
+#define PHP_PROTOBUF_VERSION "3.21.12"
 
 // ptr -> PHP object cache. This is a weak map that caches lazily-created
 // wrapper objects around upb types:
diff --git a/protobuf_deps.bzl b/protobuf_deps.bzl
index 6aee8b76dd..0949ef370a 100644
--- a/protobuf_deps.bzl
+++ b/protobuf_deps.bzl
@@ -117,6 +117,6 @@ def protobuf_deps():
         _github_archive(
             name = "upb",
             repo = "https://github.com/protocolbuffers/upb",
-            commit = "969f6fdb88e94ced87953e53716893c68ec7b1ce",
-            sha256 = "6754b7f95c92f69a832a82931aea40d066cc689dbc1eb3348b84c1ed95285296",
+            commit = "20b542a767139732548f7b8cf28c4c928cdcb07b",
+            sha256 = "c77158955326f9e9a0cf8481c118b8ad5c34df99e5db3af27f3d1662d8bedef7",
         )
diff --git a/protobuf_version.bzl b/protobuf_version.bzl
index 20c8577813..4ac031cb3b 100644
--- a/protobuf_version.bzl
+++ b/protobuf_version.bzl
@@ -1,4 +1,4 @@
-PROTOC_VERSION = "21.11"
-PROTOBUF_JAVA_VERSION = "3.21.11"
-PROTOBUF_PYTHON_VERSION = "4.21.11"
-PROTOBUF_PHP_VERSION = "3.21.11"
+PROTOC_VERSION = "21.12"
+PROTOBUF_JAVA_VERSION = "3.21.12"
+PROTOBUF_PYTHON_VERSION = "4.21.12"
+PROTOBUF_PHP_VERSION = "3.21.12"
diff --git a/protoc-artifacts/pom.xml b/protoc-artifacts/pom.xml
index af9b177d38..9d4c7f24f5 100644
--- a/protoc-artifacts/pom.xml
+++ b/protoc-artifacts/pom.xml
@@ -8,7 +8,7 @@
   </parent>
   <groupId>com.google.protobuf</groupId>
   <artifactId>protoc</artifactId>
-  <version>3.21.11</version>
+  <version>3.21.12</version>
   <packaging>pom</packaging>
   <name>Protobuf Compiler</name>
   <description>
diff --git a/python/google/protobuf/__init__.py b/python/google/protobuf/__init__.py
index 7c66e4e207..e7555ee101 100644
--- a/python/google/protobuf/__init__.py
+++ b/python/google/protobuf/__init__.py
@@ -30,4 +30,4 @@
 
 # Copyright 2007 Google Inc. All Rights Reserved.
 
-__version__ = '4.21.11'
+__version__ = '4.21.12'
diff --git a/ruby/ext/google/protobuf_c/ruby-upb.c b/ruby/ext/google/protobuf_c/ruby-upb.c
index 85b1d0f2ff..3d3c35be93 100755
--- a/ruby/ext/google/protobuf_c/ruby-upb.c
+++ b/ruby/ext/google/protobuf_c/ruby-upb.c
@@ -5814,7 +5814,6 @@ upb_EnumReservedRange* _upb_EnumReservedRanges_New(
         google_protobuf_EnumDescriptorProto_EnumReservedRange_start(protos[i]);
     const int32_t end =
         google_protobuf_EnumDescriptorProto_EnumReservedRange_end(protos[i]);
-    const int32_t max = kUpb_MaxFieldNumber + 1;
 
     // A full validation would also check that each range is disjoint, and that
     // none of the fields overlap with the extension ranges, but we are just
@@ -5822,7 +5821,7 @@ upb_EnumReservedRange* _upb_EnumReservedRanges_New(
 
     // Note: Not a typo! Unlike extension ranges and message reserved ranges,
     // the end value of an enum reserved range is *inclusive*!
-    if (start < 1 || end < start || end > max) {
+    if (end < start) {
       symtab_errf(ctx, "Reserved range (%d, %d) is invalid, enum=%s\n",
                            (int)start, (int)end, upb_EnumDef_FullName(e));
     }
@@ -7855,7 +7854,7 @@ static void create_fielddef(
     CHK_OOM(
         upb_strtable_insert(&oneof->ntof, name.data, name.size, v, ctx->arena));
   } else {
-    if (f->proto3_optional_) {
+    if (f->proto3_optional_ && !is_extension) {
       symtab_errf(ctx, "field with proto3_optional was not in a oneof (%s)",
                   f->full_name);
     }
diff --git a/ruby/google-protobuf.gemspec b/ruby/google-protobuf.gemspec
index dbfb04d7a1..a925fdcd04 100644
--- a/ruby/google-protobuf.gemspec
+++ b/ruby/google-protobuf.gemspec
@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name        = "google-protobuf"
-  s.version     = "3.21.11"
+  s.version     = "3.21.12"
   git_tag       = "v#{s.version.to_s.sub('.rc.', '-rc')}" # Converts X.Y.Z.rc.N to vX.Y.Z-rcN, used for the git tag
   s.licenses    = ["BSD-3-Clause"]
   s.summary     = "Protocol Buffers"
diff --git a/ruby/pom.xml b/ruby/pom.xml
index 537a504446..68dadacfb0 100644
--- a/ruby/pom.xml
+++ b/ruby/pom.xml
@@ -9,7 +9,7 @@
 
     <groupId>com.google.protobuf.jruby</groupId>
     <artifactId>protobuf-jruby</artifactId>
-    <version>3.21.11</version>
+    <version>3.21.12</version>
     <name>Protocol Buffer JRuby native extension</name>
     <description>
       Protocol Buffers are a way of encoding structured data in an efficient yet
@@ -76,7 +76,7 @@
         <dependency>
           <groupId>com.google.protobuf</groupId>
           <artifactId>protobuf-java-util</artifactId>
-          <version>3.21.11</version>
+          <version>3.21.12</version>
         </dependency>
         <dependency>
             <groupId>org.jruby</groupId>
diff --git a/ruby/travis-test.sh b/ruby/travis-test.sh
index f7fa8155ec..141211b32f 100755
--- a/ruby/travis-test.sh
+++ b/ruby/travis-test.sh
@@ -13,7 +13,8 @@ test_version() {
       "rvm install $version && rvm use $version && rvm get head && \
        which ruby && \
        git clean -f && \
-       gem install --no-document bundler && bundle && \
+       gem install --no-document bundler -v 2.3.26 && \ # Pin to bundler with ruby 2.5
+       bundle && \
        rake test && \
        rake gc_test && \
        cd ../conformance && make test_jruby && \
diff --git a/src/Makefile.am b/src/Makefile.am
index c5087f57e3..f48f7d44df 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -18,7 +18,7 @@ else
 PTHREAD_DEF =
 endif
 
-PROTOBUF_VERSION = 32:11:0
+PROTOBUF_VERSION = 32:12:0
 
 if GCC
 # Turn on all warnings except for sign comparison (we ignore sign comparison
diff --git a/src/google/protobuf/any.pb.h b/src/google/protobuf/any.pb.h
index c35eaddaeb..2c0605267c 100644
--- a/src/google/protobuf/any.pb.h
+++ b/src/google/protobuf/any.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/api.pb.h b/src/google/protobuf/api.pb.h
index 36f480c83d..2c4548920b 100644
--- a/src/google/protobuf/api.pb.h
+++ b/src/google/protobuf/api.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/compiler/plugin.pb.h b/src/google/protobuf/compiler/plugin.pb.h
index 0c3c5b4e0c..5f3fa52cd1 100644
--- a/src/google/protobuf/compiler/plugin.pb.h
+++ b/src/google/protobuf/compiler/plugin.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/descriptor.pb.h b/src/google/protobuf/descriptor.pb.h
index f40e966543..9ae046ab11 100644
--- a/src/google/protobuf/descriptor.pb.h
+++ b/src/google/protobuf/descriptor.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/duration.pb.h b/src/google/protobuf/duration.pb.h
index 0794e0af76..a5272c8114 100644
--- a/src/google/protobuf/duration.pb.h
+++ b/src/google/protobuf/duration.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/empty.pb.h b/src/google/protobuf/empty.pb.h
index 1dfbb1d2a0..bcb647863e 100644
--- a/src/google/protobuf/empty.pb.h
+++ b/src/google/protobuf/empty.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/field_mask.pb.h b/src/google/protobuf/field_mask.pb.h
index 27cbd7fab1..8f90e4c04f 100644
--- a/src/google/protobuf/field_mask.pb.h
+++ b/src/google/protobuf/field_mask.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/port_def.inc b/src/google/protobuf/port_def.inc
index 2680acdbd5..37567f90bc 100644
--- a/src/google/protobuf/port_def.inc
+++ b/src/google/protobuf/port_def.inc
@@ -178,7 +178,7 @@
 #ifdef PROTOBUF_VERSION
 #error PROTOBUF_VERSION was previously defined
 #endif
-#define PROTOBUF_VERSION 3021011
+#define PROTOBUF_VERSION 3021012
 
 #ifdef PROTOBUF_MIN_HEADER_VERSION_FOR_PROTOC
 #error PROTOBUF_MIN_HEADER_VERSION_FOR_PROTOC was previously defined
@@ -879,13 +879,45 @@
 #undef DEBUG
 #endif // defined(__clang__) || PROTOBUF_GNUC_MIN(3, 0) || defined(_MSC_VER)
 
-#if PROTOBUF_GNUC_MIN(3, 0)
+// Protobuf does not support building with a number of warnings that are noisy
+// (and of variable quality across compiler versions) or impossible to implement
+// effectively but which people turn on anyways.
+#ifdef __clang__
+#pragma clang diagnostic push
+// -Wshorten-64-to-32 is a typical pain where we diff pointers.
+//   char* p = strchr(s, '\n');
+//   return p ? p - s : -1;
+#pragma clang diagnostic ignored "-Wshorten-64-to-32"
+// Turn on -Wdeprecated-enum-enum-conversion. This deprecation comes in C++20
+// via http://wg21.link/p1120r0.
+#pragma clang diagnostic error "-Wdeprecated-enum-enum-conversion"
+// This error has been generally flaky, but we need to disable it specifically
+// to fix https://github.com/protocolbuffers/protobuf/issues/12313
+#pragma clang diagnostic ignored "-Wunused-parameter"
+#endif
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+// Some of the warnings below only exist in some GCC versions; those version
+// ranges are poorly documented.
+#pragma GCC diagnostic ignored "-Wpragmas"
 // GCC does not allow disabling diagnostics within an expression:
 // https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60875, so we disable this one
 // globally even though it's only used for PROTOBUF_FIELD_OFFSET.
-#pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Winvalid-offsetof"
-#endif
+// Some versions of GCC seem to think that
+//  [this] { Foo(); }
+// leaves `this` unused, even though `Foo();` is a member function of the
+// captured `this`.
+// https://bugzilla.mozilla.org/show_bug.cgi?id=1373625
+#pragma GCC diagnostic ignored "-Wunused-lambda-capture"
+// -Wsign-conversion causes a lot of warnings on mostly code like:
+//   int index = ...
+//   int value = vec[index];
+#pragma GCC diagnostic ignored "-Wsign-conversion"
+// This error has been generally flaky, but we need to disable it specifically
+// to fix https://github.com/protocolbuffers/protobuf/issues/12313
+#pragma GCC diagnostic ignored "-Wunused-parameter"
+#endif  // __GNUC__
 
 // Silence some MSVC warnings in all our code.
 #ifdef _MSC_VER
diff --git a/src/google/protobuf/port_undef.inc b/src/google/protobuf/port_undef.inc
index e880fa5c59..407b748e81 100644
--- a/src/google/protobuf/port_undef.inc
+++ b/src/google/protobuf/port_undef.inc
@@ -154,6 +154,10 @@
 #pragma GCC diagnostic pop
 #endif
 
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+
 // Pop the warning(push) from port_def.inc
 #ifdef _MSC_VER
 #pragma warning(pop)
diff --git a/src/google/protobuf/source_context.pb.h b/src/google/protobuf/source_context.pb.h
index 833c1e735d..63e7d113cd 100644
--- a/src/google/protobuf/source_context.pb.h
+++ b/src/google/protobuf/source_context.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/struct.pb.h b/src/google/protobuf/struct.pb.h
index 57e955c84e..002aa85dc1 100644
--- a/src/google/protobuf/struct.pb.h
+++ b/src/google/protobuf/struct.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/stubs/common.h b/src/google/protobuf/stubs/common.h
index c4e6f48fdf..0b9fa812da 100644
--- a/src/google/protobuf/stubs/common.h
+++ b/src/google/protobuf/stubs/common.h
@@ -82,7 +82,7 @@ namespace internal {
 
 // The current version, represented as a single integer to make comparison
 // easier:  major * 10^6 + minor * 10^3 + micro
-#define GOOGLE_PROTOBUF_VERSION 3021011
+#define GOOGLE_PROTOBUF_VERSION 3021012
 
 // A suffix string for alpha, beta or rc releases. Empty for stable releases.
 #define GOOGLE_PROTOBUF_VERSION_SUFFIX ""
diff --git a/src/google/protobuf/timestamp.pb.h b/src/google/protobuf/timestamp.pb.h
index 44c53e97de..540194bc8e 100644
--- a/src/google/protobuf/timestamp.pb.h
+++ b/src/google/protobuf/timestamp.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/type.pb.h b/src/google/protobuf/type.pb.h
index f152a8d95b..cb8105a423 100644
--- a/src/google/protobuf/type.pb.h
+++ b/src/google/protobuf/type.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/src/google/protobuf/unittest_lite.proto b/src/google/protobuf/unittest_lite.proto
index 010d4a9c0b..e2730c6419 100644
--- a/src/google/protobuf/unittest_lite.proto
+++ b/src/google/protobuf/unittest_lite.proto
@@ -47,6 +47,7 @@ message TestAllTypesLite {
   message NestedMessage {
     optional int32 bb = 1;
     optional int64 cc = 2;
+    repeated int32 dd = 3 [packed = true];
   }
 
   message NestedMessage2 {
diff --git a/src/google/protobuf/wrappers.pb.h b/src/google/protobuf/wrappers.pb.h
index 4270adfafa..0f4b8350b2 100644
--- a/src/google/protobuf/wrappers.pb.h
+++ b/src/google/protobuf/wrappers.pb.h
@@ -13,7 +13,7 @@
 #error incompatible with your Protocol Buffer headers. Please update
 #error your headers.
 #endif
-#if 3021011 < PROTOBUF_MIN_PROTOC_VERSION
+#if 3021012 < PROTOBUF_MIN_PROTOC_VERSION
 #error This file was generated by an older version of protoc which is
 #error incompatible with your Protocol Buffer headers. Please
 #error regenerate this file with a newer version of protoc.
diff --git a/version.json b/version.json
index d134b24033..27f5e48990 100644
--- a/version.json
+++ b/version.json
@@ -1,17 +1,17 @@
 {
     "21.x": {
-        "protoc_version": "21.12-dev",
+        "protoc_version": "21.13-dev",
         "lts": false,
-        "date": "2022-12-08",
+        "date": "2022-12-16",
         "languages": {
-            "cpp": "3.21.12-dev",
-            "csharp": "3.21.12-dev",
-            "java": "3.21.12-dev",
-            "javascript": "3.21.12-dev",
-            "objectivec": "3.21.12-dev",
-            "php": "3.21.12-dev",
-            "python": "4.21.12-dev",
-            "ruby": "3.21.12-dev"
+            "cpp": "3.21.13-dev",
+            "csharp": "3.21.13-dev",
+            "java": "3.21.13-dev",
+            "javascript": "3.21.13-dev",
+            "objectivec": "3.21.13-dev",
+            "php": "3.21.13-dev",
+            "python": "4.21.13-dev",
+            "ruby": "3.21.13-dev"
         }
     }
 }
\ No newline at end of file